Your crypto wallet was drained after a fake site: what to do
You connected your wallet to a site, clicked “approve” or “sign,” and a short while later your balance was gone. Or it has not been emptied yet, but you have a sinking feeling about something you signed. Either way, the first thing to know is that this is common, it is a crime done to you, and it is not a sign that you were careless in some way you should be ashamed of. The sites behind these thefts are built to look exactly like the real thing.
What you do in the next hour matters, so this guide starts with that and then moves to what comes after.
What a wallet drainer actually does
A wallet drainer is a malicious website or app that tricks you into signing a transaction or granting a permission. It usually shows up as a fake airdrop, a fake mint, a cloned exchange or DeFi page, or a link from a hacked social account. When you connect, it asks for a signature that looks routine. What you are really signing is often an approval that lets the scammer’s address move your tokens or NFTs whenever they like.
This is different from handing over your recovery phrase, though the two can overlap. If you typed your phrase into any site or form, read our guide on what to do if you gave a scammer your seed phrase, because the steps are stricter. A drainer approval can be undone. A leaked phrase cannot.
If assets are still in the wallet, move them first
If anything is left, the priority is getting it somewhere the scammer has no access. Create a brand new wallet on a different, clean device if you can, with a new recovery phrase that you write down on paper and never type into anything online. Then move what remains, starting with the most valuable assets. Do not reuse the old wallet afterward, even if you revoke permissions, because you cannot be sure what else was exposed.
Moving funds costs a small network fee, and you will need a little of the native coin in the compromised wallet to pay it. A drainer bot sometimes sweeps any incoming gas immediately, so work quickly and calmly, and accept that you may not save everything.
Revoke the approvals
If you want to keep using the old address for any reason, or you simply want to cut off the attacker, revoke the token approvals. Free tools such as Revoke.cash, or the approval checker built into the block explorer for your network, list every permission your address has granted and let you cancel the suspicious ones. Look for approvals set to “unlimited” or to addresses you do not recognize, especially any created around the time of the incident. Revoking costs a small fee for each one.
Be careful where you find these tools. Scammers buy ads and build lookalike “revoke” and “recovery” sites to drain the same victims a second time. Type the address yourself or use a bookmark you made earlier, and ignore anyone who messages you offering to recover your funds.
Write down what happened while it is fresh
Before the details blur, record the link or site you used, how you found it, the time, your wallet address, and the transaction hashes of the approval and the theft. Take screenshots of the site if it is still up, and of any message or post that led you there. Block explorers keep a permanent public record of every transfer, so the hashes are your anchor. Our guide to the first 24 hours after a crypto scam covers the wider evidence checklist.
Report it
File a report with the FBI’s Internet Crime Complaint Center at IC3.gov and with the FTC at ReportFraud.ftc.gov, and include the addresses and transaction hashes. If any funds went on to an exchange, that exchange may be able to freeze an account, so tell them promptly with your case details. Also report the fake site to the hosting provider and to the wallet or marketplace it imitated, which sometimes gets it taken down before it catches someone else.
Can the money be traced or recovered?
Honestly, recovery is difficult and often not possible. Drainers move funds fast, split them across addresses, and swap them through mixers or bridges. Tracing is still worth doing in many cases, because stolen funds sometimes land at an exchange where a freeze request is possible, and a clean trace gives law enforcement something concrete to act on. Our pieces on whether a crypto scam can be reversed and how a scammer’s wallet is traced explain what is realistic.
Be wary of anyone who guarantees a recovery. Real investigators will not promise one, and will tell you plainly what the odds look like before you pay for anything.
Protecting yourself going forward
Treat any request to connect a wallet or sign something as a decision worth pausing on, particularly when it arrives through a link, a direct message, or an unexpected “airdrop.” Read what the signing prompt actually says, and refuse anything that asks for broad or unlimited permission you cannot explain. Keep long-term holdings in a hardware wallet that you rarely connect to anything, and use a separate small wallet for experiments. And check your approvals every so often the way you would check your bank statements.
Losing money this way is painful, and the feeling that you should have known is part of how these scams work on people. If you would like help documenting what happened or tracing where the funds went, you can reach us privately, and we will tell you straight what is and is not possible.
— Gus